Enterprise document classification

Abstract

A collection of documents or other files and the like within an enterprise network are labelled according to an enterprise document classification scheme, and then a recognition model such as a neural network or other machine learning model can be used to automatically label other files throughout the enterprise network. In this manner, documents and the like throughout an enterprise can be automatically identified and managed according to features such as confidentiality, sensitivity, security risk, business value, and so forth.

What is claimed is: 
     
         1 . A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
 selecting a plurality of documents stored in an enterprise network;   labeling each of the plurality of documents with a business value, wherein the business value for each one of the plurality of documents is based at least in part on an estimated monetary value associated with a public dissemination of information contained in the one of the plurality of documents, thereby providing a labeled data set;   configuring a recognition model with the labeled data set to score the business value for a new document with a continuous variable indicative of the estimated monetary value based on at least one a file location of the new document in the enterprise network, an organization role of a user in an access control list associated with the new document, and a content of the new document;   selecting a document in the enterprise network other than the plurality of documents in the labeled data set to use as the new document;   scoring the business value of the new document with the recognition model; and   applying an enterprise policy to the new document based upon the business value, wherein the enterprise policy controls at least one of document access and document movement.   
     
     
         2 . The computer program product of  claim 1  wherein the recognition model includes a machine learning model trained to estimate monetary value based on the labeled data set. 
     
     
         3 . A method comprising:
 selecting a plurality of files stored in an enterprise network;   labeling each of the plurality of files with a business value, wherein the business value for each one of the plurality of files is based on at least an estimated monetary value associated with a security compromise of the one of the plurality of files, thereby providing a labeled data set;   configuring a recognition model with the labeled data set to score the business value for a new file with a continuous variable indicative of the estimated monetary value associated with the security compromise based on at least one of a file location of the new file in the enterprise network, an organization role of a user in an access control list associated with the new file, and a content of the new file;   selecting a document in the enterprise network other than the plurality of files in the labeled data set to use as the new file;   scoring the business value of the new file with the recognition model; and   applying an enterprise policy to the new file based upon the business value.   
     
     
         4 . The method of  claim 3  further comprising taking action to prevent distribution of the new file based on the business value of the new file. 
     
     
         5 . The method of  claim 3  further comprising labeling the new file with the business value. 
     
     
         6 . The method of  claim 3  wherein labeling each of the plurality of files includes automatically labeling each of the plurality of files with an organizational role associated with a folder where a corresponding one of the plurality of files is located. 
     
     
         7 . The method of  claim 3  wherein labeling each of the plurality of files includes automatically labeling each of the plurality of files based upon a corresponding organizational role of one or more users associated with each of the plurality of files. 
     
     
         8 . The method of  claim 3  wherein labeling each of the plurality of files includes automatically labeling each of the plurality of files based on permissions in a corresponding access control list. 
     
     
         9 . The method of  claim 3  wherein labeling each of the plurality of files includes manually labeling one or more of the plurality of files. 
     
     
         10 . The method of  claim 3  wherein the business value includes an estimated business impact of public dissemination of file content. 
     
     
         11 . The method of  claim 3  wherein the business value includes an estimated dollar value of file content. 
     
     
         12 . The method of  claim 3  wherein the business value is based on one or more of encryption status, file type, file usage history, file creation date, file modification date, file content, and file author. 
     
     
         13 . The method of  claim 3  wherein the business value is based on one or more of ownership, authorship, and access controls. 
     
     
         14 . The method of  claim 3  wherein the business value is associated with storage attributes of a data store where each of the plurality of files is located. 
     
     
         15 . The method of  claim 3  wherein the business value includes one or more of highly confidential, moderately confidential, and non-confidential. 
     
     
         16 . The method of  claim 3  wherein the business value includes an importance of preventing loss of data in each of the plurality of files. 
     
     
         17 . A system comprising:
 a training system with a first processor and a first memory, the first memory including instructions that, when executed by the first processor, receive a user selection of a plurality of files stored in an enterprise network, label each of the plurality of files with a labeled business value, thereby providing a labeled data set, and train a recognition model with machine learning to estimate a monetary value for a new file with a continuous value based on at least one of: an organizational role associated with a folder where a corresponding one of the plurality of files is located, a corresponding organizational role of one or more users associated with each of the plurality of files, a list of permissions for use of the corresponding one of the plurality of files, and content of the corresponding one of the plurality of files;   a labeling system with a second processor and a second memory, the second memory including instructions that, when executed by the second processor, locate other files in the enterprise network different than the plurality of files, estimate the monetary value for each of the other files, and label each of the other files with a label indicating a business value; and   a threat management facility with a third processor and a third memory, the third memory including instructions that, when executed by the third processor, apply an enterprise policy for the enterprise network to each of the other files based on the business value.   
     
     
         18 . The system of  claim 17  wherein the plurality of files includes one or more documents. 
     
     
         19 . The system of  claim 17  wherein the plurality of files includes one or more spreadsheets, word processing documents, or presentations. 
     
     
         20 . The system of  claim 17  wherein the plurality of files includes one or more executables.